Océane (@oceane)

Lance R. Vick @lrvick@mastodon.social

Saying "Don't use PGP, use SigStore or Age!" is the same class of dumb as saying "Don't use web standards, use Flash or Java embeds!".

Before advocating everyone abandon standards and use whatever tools have the better UX or defaults for your use case blindly, maybe take the time to actually understand the problems the standards are trying to solve for, and if any improvements or better implementations are in progress.

Océane @oceane@peculiar.florist

@lrvick

1. You're commenting a blog post. People can sit back and interpret it as a 2024 state of the art of the current cryptographic infrastructure, so to say, to find out what's incomplete and where we should put more effort, e.g., what's preventing @delta from switching to a more modern cryptographic standard.

2. Be mindful of the use cases for which you're putting minorities at risk. This blog post was written by a cryptography engineer who knows how bug-prone implementing OpenPGP is. IMHO, a group chat using 5 different OpenPGP implementations on Yahoo mail servers shouldn't be treated as zero-access. Delta Chat may be a good WhatsApp replacement for family groups but advocating for this kind of decentralization against State-level threat models is plainly dangerous.

Having a sociology graduate explain this to you means that at least one of these two posts is incredibly bad.

⭐2

Hartmut Goebel @kirschwipfel@nerdculture.de

This blog post was written by a cryptography engineer who knows

Maybe he/she "knows". But the blog post read more like a rant than being fact based. Also the tone is rather generalizing and insulting:

The same people who believe PGP is good are also famously not great at cryptography engineering.

If you can accept that every billionaire is the result of a failed system, that’s how cryptographers feel about people using PGP.

@oceane @delta @lrvick

Martin @mdosch@muenchen.social

@kirschwipfel
It reads as 'Instead of using PGP use this potpourri of programs where each is a replacement for one function pgp provides. Also wait for some not closer defined tools I write and hereby tease that will change your life.'
@oceane @delta @lrvick

Lance R. Vick @lrvick@mastodon.social

@mdosch @kirschwipfel @oceane @delta

Confession: I actually meant to send this as a standalone post. Oh well.

GPG != PGP and modern implementations exist now.

We have one standard covering human identity bound keys covering signing, endorsement, encryptiion, distribution, discovery, etc: PGP.

Sigstore, age, minisign, ssh, etc do not solve for the problems PGP solves for.

Make something that covers the problems PGP solves, improve the spec, or implement it better.

Delta Chat @delta@chaos.social

@oceane @lrvick oh, we are very much working with and for people in heavily repressive situations and they often use #deltachat when signal, threema, WhatsApp don't work .... And even if they do. Why? Because our apps provide instant onboarding without phone numbers, multi-profile and multi-device support and a pretty secure audited and analysed key management protocol without key servers. Plus support for state of the art circumvention proxying. There is a whole lot more than PFS to consider.

⭐2

Océane @oceane@peculiar.florist

@lrvick @delta So if I get it correctly, in authoritarian States they can't use RCS and Delta Chat lets them fly under the radar?

1. I agree with the OP then, but terminally online people will interpret it in a very weird way. My last paragraph definitely crossed a line, I'm sorry.

2. Was the OP about the gap between saying "this tool should be dropped immediately" and "this tool should be replaced ASAP"?